Allow arbitrary JSON objects to be stored in Session (but not compared with equals). Test Session. Fixes #215.
Meteor.Collection now takes its optional parameters ("manager" and some
undocumented ones beginning with _) in an options dictionary.

(For backwards compatibility it still supports passing the manager directly.)
Incompatible auth change: Login services will need to be reconfigured.

Rename internal accounts packages to start with meteor_ (better namespacing) and
contain no dots (easier to use in Mongo shell).

We leave "users" un-namespaced but note that we will eventually allow
configuration.

Note that the two token collections may soon be merged into users.
Rename and refactor Accounts.updateOrCreateUser.

This is an internal function only used by OAuth implementations and the
equivalent, so rename to a more specific name:
Accounts.updateOrCreateUserFromExternalService.

Change the signature to directly take serviceName and serviceData instead of a
nested data structure with a very specific structure. Similarly, change
Accounts.oauth.registerService's handleOauthRequest callback to un-nest the
service data.

Throw errors on misuse (if you try to use it with the "password" or
soon-to-be-introduced "resume" services, or if you don't provide an id).

Avoid doing no-op user updates if there is nothing new in "extra".
Move login token generation into updateOrCreateUserFromExternalService.
Rename Accounts.onCreateUserHook to Accounts.insertUserDoc; make it actually
insert the user doc instead of just returning it, and make it (optionally)
generate a login token.
Once an SRP challenge is verified, remove it from the session.
Large refactor of accounts-ui

- Split login_buttons.html and login_buttons.js into multiple files
  - Specifically, make it easier to reason about the display of loginButtons whether it is in dropdown mode or not
- Split templates into subtemplates to make it easier to read the login button .html files as "tables of contents"
- Introduce Meteor._loginButtonsSession, which makes it easier to access internal session fields for loginButtons
- Unify code that calls the various Meteor.loginWithFoo() functions

Breaking change: rename "configureLoginServicesDialogForFoo" to "configureLoginServiceDialogForFoo" (in packages such as accounts-facebook)
accounts-ui: trim login service configuration strings
accounts: Allow specifying explicit errors in Meteor.validateNewUser
Only allow users to configure login services that are actually part of the app.

(Well, and services with names like "registerLoginHandler", but whatever.)

This prevents this attack:
  - Alice launches site with Facebook login
  - Mallory sends configureLoginService method to configure the Twitter service
  - Alice runs "meteor add accounts-twitter" and is impressed that Twitter integration
    Just Works with no configuration
  - Now the app is using Mallory's credentials
In method invocations and publish handlers, this.userId is now the userId
itself, not a function returning it.
Merge branch 'devel' into auth

Pull in the issue #215 fix (Sessions can contain non-scalar objects)
Change interface for determining if the user doc is loaded to a new reactive
function Meteor.userLoaded(), which is true if you are logged in and the user
doc is loaded, and a currentUserLoaded Handlebars helper to match.

If logged in and the user doc is not yet loaded, Meteor.user() now returns an
object which only contains _id.

The current user subscription is now named meteor.currentUser rather than being
an unnamed sub. (loginServiceConfiguration is renamed
meteor.loginServiceConfiguration to match.) This subscription is sub'd from when
you log in and unsub'd from when you log out (or if you log in with different
credentials).

I was very careful to make sure that in the case of "sub #1, unsub #1, sub #2,
sub #1 is ready" we do not declare the user to be ready. I could have instead
modified livedata_connection to not call ready callbacks for unsub'd
subscriptions (add a "delete self.sub_ready_callbacks[obj._id]" to the self.subs
removed function) but this seemed less invasive.

The password and email tests use this to take a more rigorous approach to
waiting for the data to load, and they change the localStorage keys so that
multiple tabs running tests don't interact via localStorage.
Move "resume" login tokens from a separate collection into the user doc.
Include timestamps with the tokens, so that later we can set expiry/cleanup
policies.

Observable changes:

 - tokens can no longer be used to log in as a user which no longer exists

 - when you log in with a "reset password" link, all logins in other browsers
   lose the ability to reconnect. However, other browser logins are not
   immediately disconnected, and "change password" does not invalidate any
   tokens.
Add a comment about disconnecting sessions when users or login tokens are deleted.
Move email validation tokens into the users doc.
Accounts.changePassword: consistently allow no callback to be passed.
Make sure that "reset password" links validate the correct email address.
Fix change passwords flow (bug introduced in 147ef71).
Improve error reporting in Meteor.flush.